Loading npm security reports…

playwright-email: Suspicious npm security report (Warn) | LPM Firewall

registry / playwright-email / 0.3.0

playwright-email@0.3.0

Zero-config email testing for Playwright: signup verification, password reset, magic links, email OTP and TOTP 2FA — powered by an auto-managed Mailpit instance.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 119 KB of source, external domains: 127.0.0.1, api.github.com, github.com

Source & flagged code

5 flagged

dist/global-setup.cjsView file

Lines 17-57javascript

17 }

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

21 // If the importer is in node compatibility mode or this is not an ESM

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/global-setup.ts

31var global_setup_exports = {};

32__export(global_setup_exports, {

33 default: () => globalSetup

34});

35module.exports = __toCommonJS(global_setup_exports);

37// src/server/process.ts

38var import_node_child_process2 = require("child_process");

39var import_promises3 = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/global-setup.cjsView on unpkg · L37

40var import_node_net = __toESM(require("net"), 1);

41var import_node_os2 = __toESM(require("os"), 1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/global-setup.cjsView on unpkg · L37

42var import_node_path2 = __toESM(require("path"), 1);

44// src/server/binary.ts

45var import_node_child_process = require("child_process");

46var import_node_crypto = require("crypto");

47var import_node_fs = require("fs");

48var import_promises = require("fs/promises");

49var import_node_os = __toESM(require("os"), 1);

50var import_node_path = __toESM(require("path"), 1);

51var import_node_stream = require("stream");

52var import_promises2 = require("stream/promises");

53var DEFAULT_MAILPIT_VERSION = "v1.30.4";

54var DEFAULT_DOWNLOAD_BASE = "https://github.com/axllent/mailpit/releases/download";

55var KNOWN_CHECKSUMS = {

56 "v1.30.4": {

57 "mailpit-darwin-amd64.tar.gz": "67abb8dfd693eb2a511d6860b33c87bbbdfcf0a0eb7f494134a354e186b4e79b",

dist/chunk-3JWEIFI7.jsView file

Lines 95-135javascript

95 });

96 if (!res.ok) return void 0;

97 const release = await res.json();

98 const

dist/index.jsView file

Lines 170-210javascript

170 }

171 /**

172 * Extract the first link matching the filter (by visible text and/or URL).

173 * Throws with the list of available links when nothing matches.

174 */

175 extractLink(filter = {}) {

176 const links = this

Source & flagged code

5 flagged · loading source

dist/global-setup.cjsView file

Source & flagged code

5 flagged

dist/global-setup.cjsView file

Lines 17-57javascript

17 }

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

21 // If the importer is in node compatibility mode or this is not an ESM

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/global-setup.ts

31var global_setup_exports = {};

32__export(global_setup_exports, {

33 default: () => globalSetup

34});

35module.exports = __toCommonJS(global_setup_exports);

37// src/server/process.ts

38var import_node_child_process2 = require("child_process");

39var import_promises3 = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/global-setup.cjsView on unpkg · L37

40var import_node_net = __toESM(require("net"), 1);

41var import_node_os2 = __toESM(require("os"), 1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/global-setup.cjsView on unpkg · L37

42var import_node_path2 = __toESM(require("path"), 1);

44// src/server/binary.ts

45var import_node_child_process = require("child_process");

46var import_node_crypto = require("crypto");

47var import_node_fs = require("fs");

48var import_promises = require("fs/promises");

49var import_node_os = __toESM(require("os"), 1);

50var import_node_path = __toESM(require("path"), 1);

51var import_node_stream = require("stream");

52var import_promises2 = require("stream/promises");

53var DEFAULT_MAILPIT_VERSION = "v1.30.4";

54var DEFAULT_DOWNLOAD_BASE = "https://github.com/axllent/mailpit/releases/download";

55var KNOWN_CHECKSUMS = {

56 "v1.30.4": {

57 "mailpit-darwin-amd64.tar.gz": "67abb8dfd693eb2a511d6860b33c87bbbdfcf0a0eb7f494134a354e186b4e79b",

dist/chunk-3JWEIFI7.jsView file

Lines 95-135javascript

95 });

96 if (!res.ok) return void 0;

97 const release = await res.json();

98 const

dist/index.jsView file

Lines 170-210javascript

170 }

171 /**

172 * Extract the first link matching the filter (by visible text and/or URL).

173 * Throws with the list of available links when nothing matches.

174 */

175 extractLink(filter = {}) {

176 const links = this

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code